CyberDefenders PsExec Hunt Lab

An alert from the Intrusion Detection System (IDS) flagged suspicious lateral movement activity involving PsExec. This indicates potential unauthorized access and movement across the network. As a SOC Analyst, your task is to investigate the provided PCAP file to trace the attacker’s activities. Identify their entry point, the machines targeted, the extent of the breach, and any critical indicators that reveal their tactics and objectives within the compromised environment.

1.To effectively trace the attacker’s activities within our network, can you identify the IP address of the machine from which the attacker initially gained access?

Filter with TCP and then find suspecious req and response

Also we can focus on statistics->conversation and see which ip is send more packet.Here 10.0.0.130 ip sends highest amount of packet.So answer is 10.0.0.130

2.To fully understand the extent of the breach, can you determine the machine’s hostname to which the attacker first pivoted?

Filter with ip.addr== 10.0.0.130 && smb2 and check the packet details of Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE. Here i find the name sales-pc that was the answer

3.Knowing the username of the account the attacker used for authentication will give us insights into the extent of the breach. What is the username utilized by the attacker for authentication?

In the next packet attacker send a request for username ssales , and it was the answer.

4.After figuring out how the attacker moved within our network, we need to know what they did on the target machine. What’s the name of the service executable the attacker set up on the target?

After setup remote connection, attacker request for file psexesvc.exe and it was the answer.

5.We need to know how the attacker installed the service on the compromised machine to understand the attacker’s lateral movement tactics. This can help identify other affected systems. Which network share was used by PsExec to install the service on the target machine?

Q5 asks which share was used to install/copy the service file. And here after connect with \ADMIN$ that install the service on the target machine.

6.We must identify the network share used to communicate between the two machines. Which network share did PsExec use for communication?

Q6 asks which share was used for communication between the two machines.Here \IPC$ is used for communication between machines.

7.Now that we have a clearer picture of the attacker’s activities on the compromised machine, it’s important to identify any further lateral movement. What is the hostname of the second machine the attacker targeted to pivot within our network?

I analyze and find that after sometime 10.0.0.130 establish connection with another one ip that was 10.0.0.131. Then I sure and similarly as 2nd question i find the username was marketing-pc.